RFP 2025-26-08 Questions and Responses 3.6.26.pdf

RFP 2025-26-08 Internal Audit Services Questions

1. A copy of the most recent Annual Financial Report.

2. A copy of the most recent Single Audit Report, if applicable.

3. Clarification on the licensing requirements for out-of-state CPA firms submitting a proposal. Nothing specific required by EOU, however please check the Oregon DOR for more information.

4. Information regarding the prior year’s auditor fees and/or the number of hours incurred to complete the audit. Decline to respond

5. Whether the University expects to receive and expend any federal grants of more than $1,000,000 during Fiscal Year in question. Yes

6. If there were any disagreements with the prior auditor related to accounting principles, proposed adjustments, audit scope, audit procedures, or other significant matters. Refer to audits

7. Any material audit adjustments identified during the prior year’s audit. Refer to audits

8. Any anticipated changes in operations, major capital projects, or accounting systems in the upcoming fiscal year. None at this time

9. What is the average hours per audit or the projected annual total audit hours? To be determined by vendor

10. What are the number of intake/complaints per year from the hotline? 5-10

11. Does the university currently have an internal audit provider? Yes, Kernutt Stokes

12. Will any staff participate in audit projects (co-sourcing) or should the provider assume fully outsourced execution? Fully outsourced

13. To whom will the internal audit provider formally report to? Board of Trustees

14. Does a system wide enterprise risk assessment currently exist? If yes, when was it last performed and is it available for review? Kernutt Stokes has provided an annual assessment and audit plan for the past 5 years. The link is for the 2025-26 assessment and plan.

15. Does the university maintain a formal risk and internal control repository or enterprise risk management tool today? No

16. Does the university have a defined audit methodology, policies, issue rating scale or reporting standards? No

17. What are the primary enterprise systems and key data sources and what level of data access will be available to support data analytics? Ellucians Banner is our ERP system.

18. Is the IT governance framework for the IT Internal Audit work developed by the university?

Yes

19. Is on-site presence required, and if so, how frequently? For board meetings as available, ideally when the annual assessment is conducted and presented.

20. What is the anticipated annual budget or not-to-exceed amount for these services?

Determined based on proposals

21. Does Eastern Oregon University currently have an internal audit function or staff, and are prior audit reports or a risk register available for review? No, we do not have internal audit staff. We do have controls in place that are monitored internally. We do no have a risk https://www.eou.edu/admin/financial-reports/ https://www.eou.edu/admin/financial-reports/ https://drive.google.com/file/d/1VO0_pBVjhCDwuAQ8CSMwZzuqsgHqK7QW/view?usp=drive_link register. Yes, we do have audit reports from the audits conducted by Kernutt Stokes in the past 5 years.

22. How is the Ethics Line currently managed, and what has been the approximate volume and nature of reports received in recent years? Kernutt Stokes has managed our ethics line while under contract, prior to that it was done in house.

23. Could you please provide the most recent internal audit report? Link to current audit plan and most recent report provided to the EOU Board of Trustees Finance and Administration Committee in January 2026

24. Considering up to three audits per year, is there a university estimated hours for annual Internal Audit services budgeted? No

25. Has a budgeted dollar amount been identified for this requested RFP? No

26. Are there KPIs you are seeking for audit effectiveness during the contract? No

27. Is this a fully outsourced Internal Audit function, or are there internal resources within EOU to be utilized and/or report to during this engagement? Fully outsourced

28. Can EOU provide any prior system-wide enterprise risk assessment results, including high-risk areas across EOU? Included in the 2025-26 Assessment.

29. Outside of the system-wide enterprise risk assessment, are there other assessments performed to influence the audit plan? No

30. Additionally, are there upcoming strategic initiatives, new programs, or regulatory changes that should influence the audit plan? No

31. Which departments or operational processes are of priority areas currently for the operational and financial audits? To be determined by the vendor. Vendor to provide an array of priorities and expertise

32. Are there known internal control weaknesses or recurring audit findings to address? No

33. Is the IT governance framework for the IT Internal Audit work developed by EOU or does EOU use NIST, ISO, COBIT, etc.? Our CIO describes our approach as ITIL (more operational and adaptive) with bits of NIST and a desire to get ISO.

34. We understand this internal audit function is fully outsourced. Please confirm whether EOU anticipates maintaining a fully outsourced model throughout the contract term or if a future co-sourced or in-house model is being considered? Fully Outsourced

35. CLA’s approach typically includes an initial enterprise-wide risk assessment, CLA estimates 13-15 interviews with key stakeholders for an institution of your size. Does that seem appropriate or would you expect a higher/lower number? This is in alignment with what has been done in the past 5 years. Alternatively, does EOU already have a risk assessment that should be leveraged? Assessment should be conducted annually by vendor.

36. Is the expectation that the risk assessment will need to be refreshed each year of the contract? Annual refresh

37. Will the selected service provider be responsible for following up on the implementation status of prior recommendations and/or remediation testing (for audits completed in previous years)? Yes

38. Is cybersecurity (i.e. IT control reviews, external penetration testing, internal vulnerability assessments, other technical testing) included in the potential scope or is this performed by your internal Information Security Department or a separate third party? Yes, although penetration testing is done by another 3rd party.

https://drive.google.com/file/d/1VO0_pBVjhCDwuAQ8CSMwZzuqsgHqK7QW/view?usp=drive_link https://docs.google.com/document/d/1mle_Lw8ma57QtEB3uQS8SxsFubZi2BRx/edit?usp=drive_link&ouid=108509407200737947965&rtpof=true&sd=true

39. Does EOU have a preference for onsite versus remote audits? As long as the work can be done, remote audits are acceptable.

40. Have there been any known frauds or material control breakdowns with EOU that would impact our approach? No

41. Were there any specific concerns (with EOU or your previous service provider) that was the catalyst for this RFP? No

42. What qualities or attributes are most important to EOU in establishing a successful internal auditor relationship (e.g., communication style, higher education expertise, value-added insights)? Communication and higher education expertise are critical

43. Will you require data analytics capabilities for audits? Unknown

44. Has a previous risk assessment been performed? Yes Are there formal enterprise risk management (ERM) processes in place? Would the winning firm have access to leverage these items upon beginning the engagement? Yes

45. Are there any in-house risk management or internal audit employees or will this internal audit engagement be fully outsourced? Fully outsourced If there are in-house resources, how do you see responsibilities split between your internal team and the co sourcing provider for this engagement’s scope of work?

46. Are there specific higher education benchmarks or peer institutions that the University already leverages? No

47. Have there been any fraud or legal compliance issues that have come up in the last few years or anything else that we should be aware of or that prompted this RFP? No

48. Can the University share the potential breakdown of the planned outsourced internal audits/projects by topic (e.g., operational, financial, compliance, IT-related, research-related, construction-related, fraud investigations, etc.)? 2025-26 Assessment and Plan, otherwise determined annually by the vendor

49. Will previous internal audit documentation (e.g., process documentation, audit results) be available to the successful firm upon beginning the engagement? Yes

50. Have there been any significant internal control findings (i.e., management letters/significant deficiencies/material weaknesses) from past internal and/or external audit reviews? No

51. Does the University expect any external audit reliance on internal audit work? No

52. How many ethics line reports are typically made in a year that the outsourced internal audit function would manage? How many are brought to the attention of the Audit Committee? 5- 10, the ethics line activity is included as part of the board reports

53. Are information technology processes, policies, and procedures centralized and standardized across systems? Centralized

a. If not, please briefly summarize the extent of de-centralization/distribution and variation

54. How many data centers are used to support/host the critical/in-scope systems, and are the data centers maintained and supported internally or are they hosted and supported by third parties? 2 and internally

55. Please summarize the nature of IT services and applications that are outsourced/provided by service providers (Data center/Cloud Hosting, Help Desk, Security Monitoring, etc.)?

Combination depending on service and application. Help desk is in house, security monitoring is a combination.

56. Will more than one firm be awarded this engagement with the intention of then further using firms on an audit-by-audit basis? No we are looking for a single vendor to provide services

57. Does the University have an existing software solution for internal audit, integrated risk management, data analytics, and/or automation/machine learning that you would like the winning bidder to leverage? No If not, is the University interested in the winning bidder providing such solutions? Possibly

58. Can you confirm that EOU intends to select only one firm to serve as the fully outsourced internal audit function, or is the University looking to establish a pool of potential firms? No we are looking for a single vendor to provide services

59. Does EOU currently have an internal audit function? If yes, could you describe the existing structure? We currently have an agreement with a vendor for services.

60. What is the motivation for the current RFP? If there is an existing service provider performing these services currently, will they be included in the pool of potential respondents? The current agreement ends June 30, 2026.

61. Is EOU seeking a fully outsourced internal audit function, a co-sourced model, or another hybrid approach? Fully outsourced If co-sourced, what responsibilities will remain with

EOU?

62. Are there specific subject matter areas EOU would like the selected firm to prioritize (for example, IT and cybersecurity, grants, athletics, Title IV and financial aid, procurement, HR and payroll, research compliance, privacy, etc.)? To be determined by the annual assessment conducted by the vendor.

63. Does EOU have an enterprise risk management program (or function) and, if so, how does it intersect with internal audit? No

64. Is there an existing risk assessment or risk universe that the selected provider would build upon, or would it be starting from scratch? The 2025-26 Annual Assessment and Audit Plan is available here. Expectation is an annual assessment is conducted each year, and audits are selected from the assessment based on risk. If yes, how have historical risk assessments been completed (interviews, surveys, etc.)? Interviews and surveys

65. Could EOU share an example of a recent annual audit plan? The 2025-26 Annual Assessment and Audit Plan is available here.

66. Does EOU prefer to have the selected provider perform work on campus/in-person or can the majority of work be performed remotely? The majority can be performed remotely

67. Can you confirm if CLA is still the University’s financial statement/Single auditors? Yes, CLA is our external auditor. How do you imagine internal audit will interact with the external audit provider, if at all? No plans to interact between the two vendors.

68. What has been the typical timeline for prior internal audit engagements (for example, start to end of fieldwork, draft report issuance, management response period, and final report issuance)? Typically 3-4 months depending on the audit.

69. Please confirm that “VPFA” refers to the Vice President for Finance and Administration. That is correct

70. Does EOU have a preferred page limit or formatting guidance (for example, font size, margins, tabs, or section order) for proposal responses? No

71. How would EOU prefer respondents submit proposed edits to EOU’s standard terms and conditions (i.e., redlines or an exceptions list) as part of the proposal? All requests for changes to the EOU terms and conditions must be submitted as part of the proposal.

Only minor changes may be accepted.

72. Is there a budget established for EOU’s internal audit program? No

73. Does EOU have an assumed number of hours that should be used for the pricing estimate, or should we just leverage the assumption that the annual plan should include “up to three” audits per year and price based on our normal average level of hours per audit? No, to be determined by the vendor

74. Should we also assume a certain level of follow-up activities based on historical internal audit work? Yes

75. For the prior year(s), approximately how many hours were budgeted and or used for enterprise risk assessment, development of the annual audit plan, and execution of audit projects? Unknown

76. What systems does EOU use across campus that would be in scope for internal audit? Are there any systems that the selected provider would be expected to use as part of its work?

None

77. Banner is referenced in the background information, but could you specify which modules are in use? Finance, Student, Financial Aid, Human Resources

78. Would the selected provider be responsible for reporting to the Board of Trustee’s Finance and Administration Committee (or the full Board) on a regular basis, or only to University Management through the VPFA? If yes, how often does the Committee meet? Yes, to the BoT F&A Committee, 4-5 times per year. The 2026-27 Meeting Schedule can be found here.

79. For the requested draft engagement letter, our engagement documentation includes a Master Services Agreement and then a specific Scope(s) of Work; should we include examples of both? You may submit both, however EOU prefers to use our agreements and only minor changes may be considered if the MSA does not align.

80. Can you clarify what you are hoping to understand regarding the Dispute Resolution Process? Is this related to if we have challenges or issues in completing internal audit work (e.g., difference of opinion on findings, challenges with getting information) or intended to cover broader issues of contract conflicts? Broader issues with contract conflicts.

81. Under the Scope of Work section, what level of detail is EOU seeking for the “Proposed work plan”? For example, should we provide a sample work plan for a single audit engagement, a first-year work plan that includes risk assessment, audit plan development, and up to three audits, or an illustrative multi-year plan? Yes

82. Can you provide more information regarding the University’s Ethics Line? What tool/system is used and how many incidents/allegations are received each year? Here is the link to the webpage, 5-10 reports per year.

83. Is there a response/triage process already established for review and adjudication of Ethics Line items? Yes depending on the nature of the complaint.

https://docs.google.com/document/d/1SO90VLKYhhmdbK70wG6IAT7mlGbYNZpL/edit https://secure.ethicspoint.com/domain/media/en/gui/44178/index.html

84. Who currently administers, or most recently administered, EOU’s Ethics Line? If this will be a different provider than the internal audit firm, what relationship or coordination does EOU expect between the two? Ethics point is a tool created by NAVEX Global, the reports are sent to the internal auditor for review.

85. Based on the RFP it states that you are requesting internal audit and advisory services designed to evaluate internal controls, assess compliance, and improve operational effectiveness across the EOU. Can you please provide related information regarding any prior outsourced internal audit services performed: When was the most recent risk assessment performed before, either internally or by external consultants? The assessment was conducted for 2025-26

86. Will you be able to provide access to a copy of the most recent Risk Assessment prior to the RFP response submissions? If not, would the successful vendor have access to the prior risk assessment and any internal audit reports? Here is the link to the 2025- 26 Assessment.

87. What are the core systems being utilized for day-to-day operations, including but not limited to: financial, payroll/HR, procurement, contracting, grants management, student data and records, financial aid, and any others? Ellucians Banner

88. Are any of the systems identified going to be or anticipated to be changed or upgraded during the engagement period? No

89. Were there any major IT system failures, issues, or breaches noted during the current fiscal year, or previous three fiscal years? No

90. Are primary functions/business processes for day-to-day operations centralized or decentralized by location? Centralized

91. Are policies and procedures centralized for all locations/departments? Who owns those policies and procedures? Centralized, primarily F&A is the owner If yes, please describe their role and the core processes they are involved in and what departments they work with. If yes, will we be able to interview those third-party providers?

92. Do your contracts have right-to-audit clauses? See the terms and conditions provide in the

RFP

93. Will a liaison(s) be provided to the consultant during the engagement to ensure that data is available in the time manner needed to meet the objectives and milestones? Yes, the VPFA will serve as a the liaison

94. What is the anticipated budget for the risk assessment and the requested three-year audit plan? Unknown

95. With respect to the availability of internal audit documentation that may assist in reducing our costs: Does EOU have documented internal control procedures/memos, key business processes, policies, procedures? When was the last time they were reviewed? Many of these are reviewed during our external audit.

96. We understand the Core campus includes many buildings including living quarters, as well as centers across Oregon. Can you confirm the intention is to include those centers in the Audit Universe for the Risk Assessment? All functions of EOU would be included.

97. Are there any buildings, departments, or centers that would be excluded from the Audit Universe? If yes, can you provide which ones and a brief explanation of why they would be excluded? No

98. Is it EOU’s expectation to have the Internal Audit Services performed remotely, in-person, or a hybrid model? If hybrid, can you please describe your preference for the in-person portion, such as meetings, walkthroughs/workshops/interviews, presentations? Audits can be conducted remotely, however we do ask for onsite presentations for at least the annual plan. The 2026-27 Board Meeting Schedule can be found here.

99. Upon award for new client engagement, our process also includes a requirement to sign a Master Service Agreement (MSA) on commercially reasonable terms along with annual Statements of Work. Is the EOU amenable to signing those? We can review the MSA however EOU prefers to use our agreements/terms and conditions and only minor changes may be considered if the MSA does not align.

https://docs.google.com/document/d/1SO90VLKYhhmdbK70wG6IAT7mlGbYNZpL/edit